T09 · Insecure Skill Coding Practices
- Location
scripts/prepare.py:443- Finding
Automatic Target Substitution Can Trigger Failover on an Unapproved RDS Instance
- Content
View full analysis
Vulnerability Details
File Locations:
scripts/prepare.py:443-455scripts/execute.py:280-283scripts/execute.py:165-169scripts/execute.py:441-442
Vulnerability Type: Improper authorization of a destructive operation target
Risk Level: HighComplete Code Snippets
scripts/prepare.py:443-455:python # 选择目标实例 — 优先使用 config.json 中的 instance_id target = next((i for i in ha_instances if i["id"] == instance_id), None) if not target: if len(ha_instances) == 1: target = ha_instances[0] instance_id = target["id"] # 同步更新，后续 experiment.json 和 execute 均使用新值 print(f" config.json 中的 instance_id 未匹配，区域仅有 1 个 HA 实例:") print(f" 名称: {target['name']}") print(f" ID: {instance_id}") print(f" 引擎: {target['engine']} 状态: {target['status']}") print(f" ⚠ 此实例未经 config.json 显式指定，请确认无误。")scripts/execute.py:280-283:python exp_instance_id = experiment.get("target", {}).get("instance_id") if exp_instance_id and exp_instance_id != instance_id: instance_id = exp_instance_id print(f"[配置] instance_id 已从 experiment.json 覆盖为 {instance_id}")scripts/execute.py:165-169:python def execute_failover(region, instance_id): """调用 StartFailover API""" resp = run_hcloud("RDS", "StartFailover", region, [f"--instance_id={instance_id}"]) if resp.get("_error"): return None, resp.get("stderr")scripts/execute.py:441-442:python print(f"\n[执行] 调用 StartFailover...") failover_resp, failover_err = execute_failover(region, instance_id)Technical Analysis
The user identifies the authorized failover target through
config/config.json. During preparation, however, if that configured instance ID does not match any enumerated HA instance and the region contains exactly one HA instance, the code silently changes the effective target to that instance.Although the preparation script prints a warning asking the user to confirm the replacem ...[truncated 3079 chars]
- Remediation
View remediation
Remediation Suggestions
-
Fail closed on target mismatch
If the configuredinstance_iddoes not match an enumerated HA instance, terminate preparation with an error. Do not automatically select the sole instance in the region. -
Require explicit target authorization
If fallback selection is retained, require a dedicated option containing the exact replacement identifier, such as:bash --confirm-target <instance-id>The supplied value must exactly match the selected instance before writing executable artifacts.
-
Enforce configuration consistency during execution
Reject execution whenconfig.json,experiment.json, andrisk_assessment.jsondo not contain identical region and instance identifiers. Do not treat generated artifacts as automatically authoritative over the user-controlled configuration. -
Bind confirmation to the target
Replace the generic--yesauthorization with target-specific confirmation for destructive operations, or require both--yesand an exact target assertion. -
Protect generated artifacts
Record the authorized region and instance ID in a manifest and verify its integrity before execution. At minimum, validate ownership and reject unexpected target changes between preparation and execution. -
Display the final target immediately before execution
Present the final instance name, ID, region, and engine immediately beforeStartFailover. For interactive use, require an exact typed confirmation; for automation, require an equivalent non-interactive target-binding parameter. -
Add regression tests
Tests should verify that:- An unmatched configured ID always fails closed.
- A sole regional HA instance is never selected implicitly.
- Any mismatch among configuration and generated artifacts blocks
StartFailover. - Generic
--yescannot authorize a changed target.
-